https://community.splunk.com/t5/Splunk-Search/how-to-combine-two-searches-into-one-chart-using-checkbox-input/m-p/573939#M200013 <P>Try something like this</P><LI-CODE lang="markup">index1 : MicronSite IN($input_site$) index=mtparam sourcetype=CommandTimesByArea | rex field=_raw "Fabwide:AvgTotalTrackoutTime\s+(?&lt;AvgTotalTrackoutTime&gt;\d+)" | timechart span=12h avg(AvgTotalTrackoutTime) aligntime=@d+7h by MicronSite | join type=left _time [ search index2 : MicronSite=F6 index=mfg source=command_times area_id=Fabwide command_name IN (SigmaRunComplete,MESLotTrackOut) | timechart partial=f span=12h aligntime=@d+7h avg(avg) by command_name | addtotals fieldname=AvgTotalTrackoutTime ]</LI-CODE> Sun, 07 Nov 2021 17:00:52 GMT ITWhisperer 2021-11-07T17:00:52Z https://community.splunk.com/t5/Splunk-Search/how-to-combine-two-searches-into-one-chart-using-checkbox-input/m-p/573937#M200011 <P>i have initial query with one index name(index1)&nbsp; which show F10N F10W F11 etc values in one chart but for F6 value comes from different index (index2) . how should i combine that F6 value into one chart.</P><P>index1 :&nbsp;MicronSite IN($input_site$) index=mtparam sourcetype=CommandTimesByArea | rex field=_raw "Fabwide:AvgTotalTrackoutTime\s+(?&lt;AvgTotalTrackoutTime&gt;\d+)" | timechart span=12h avg(AvgTotalTrackoutTime) aligntime=@d+7h by MicronSite</P><P>index2 :&nbsp;MicronSite=F6 index=mfg source=command_times area_id=Fabwide command_name IN (SigmaRunComplete,MESLotTrackOut)<BR />| timechart partial=f span=12h aligntime=@d+7h avg(avg) by command_name<BR />| addtotals fieldname=AvgTotalTrackoutTime</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="florapann_0-1636299153644.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16762i261FF7899785745B/image-size/medium?v=v2&amp;px=400" role="button" title="florapann_0-1636299153644.png" alt="florapann_0-1636299153644.png" /></span></P><P>&nbsp;</P> Sun, 07 Nov 2021 15:37:46 GMT https://community.splunk.com/t5/Splunk-Search/how-to-combine-two-searches-into-one-chart-using-checkbox-input/m-p/573937#M200011 florapann 2021-11-07T15:37:46Z https://community.splunk.com/t5/Splunk-Search/how-to-combine-two-searches-into-one-chart-using-checkbox-input/m-p/573939#M200013 <P>Try something like this</P><LI-CODE lang="markup">index1 : MicronSite IN($input_site$) index=mtparam sourcetype=CommandTimesByArea | rex field=_raw "Fabwide:AvgTotalTrackoutTime\s+(?&lt;AvgTotalTrackoutTime&gt;\d+)" | timechart span=12h avg(AvgTotalTrackoutTime) aligntime=@d+7h by MicronSite | join type=left _time [ search index2 : MicronSite=F6 index=mfg source=command_times area_id=Fabwide command_name IN (SigmaRunComplete,MESLotTrackOut) | timechart partial=f span=12h aligntime=@d+7h avg(avg) by command_name | addtotals fieldname=AvgTotalTrackoutTime ]</LI-CODE> Sun, 07 Nov 2021 17:00:52 GMT https://community.splunk.com/t5/Splunk-Search/how-to-combine-two-searches-into-one-chart-using-checkbox-input/m-p/573939#M200013 ITWhisperer 2021-11-07T17:00:52Z https://community.splunk.com/t5/Splunk-Search/how-to-combine-two-searches-into-one-chart-using-checkbox-input/m-p/573955#M200023 <P>when i run the query , it shows below like this. how should i remove that&nbsp; two column from chart?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="florapann_0-1636339702191.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16763iF274639CC607D283/image-size/medium?v=v2&amp;px=400" role="button" title="florapann_0-1636339702191.png" alt="florapann_0-1636339702191.png" /></span></P><P>&nbsp;</P> Mon, 08 Nov 2021 02:49:37 GMT https://community.splunk.com/t5/Splunk-Search/how-to-combine-two-searches-into-one-chart-using-checkbox-input/m-p/573955#M200023 florapann 2021-11-08T02:49:37Z https://community.splunk.com/t5/Splunk-Search/how-to-combine-two-searches-into-one-chart-using-checkbox-input/m-p/573980#M200027 <LI-CODE lang="markup">| fields - MESLofTrackOut SignalRunComplete</LI-CODE> Mon, 08 Nov 2021 08:20:35 GMT https://community.splunk.com/t5/Splunk-Search/how-to-combine-two-searches-into-one-chart-using-checkbox-input/m-p/573980#M200027 ITWhisperer 2021-11-08T08:20:35Z